CVE-2025-22248

Estado: AnalizadaCrítica (9.4)—

The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 9.4

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.50%
Percentil entre todas las CVEs puntuadas: 41
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement95 %
Impacto principalT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access90 %
Impacto secundarioT1005 Data from Local Systemcollection85 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact75 %

Acceso de red adyacente sin autenticación (AV:A, PR:N, UI:N) a PostgreSQL mediante usuario 'repmgr' predeterminado; permite lectura/manipulación de datos en la BD.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Password Policies Remote Data Storage

Tecnologías afectadas (2)

Broadcom — Bitnami Broadcom — Bitnami/pgpool

CWE

CWE-1188

Referencias

https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-22248",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22248",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-13T13:10:00.979591Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "Bitnami",
          "versions": [
            {
              "status": "affected",
              "version": "*",
              "lessThan": "4.6.0-debian-12-r8",
              "versionType": "git"
            }
          ],
          "packageName": "bitnami/pgpool",
          "defaultStatus": "affected"
        },
        {
          "vendor": "VMware",
          "product": "Bitnami",
          "versions": [
            {
              "status": "affected",
              "version": "*",
              "lessThan": "16.0.0",
              "versionType": "git"
            }
          ],
          "packageName": "bitnami/postgres-ha",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-05-13T10:15:22.600",
  "references": [
    {
      "url": "https://github.com/bitnami/charts/security/advisories/GHSA-mx38-x658-5fwj",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart."
    },
    {
      "lang": "es",
      "value": "La imagen de Docker bitnami/pgpool y el diagrama k8s bitnami/postgres-ha, en la configuración predeterminada, incluyen el usuario \"repmgr\" que permite el acceso no autenticado a la base de datos dentro del clúster. PGPOOL_SR_CHECK_USER es el usuario que Pgpool utiliza para realizar comprobaciones de replicación en streaming en los nodos y no debe tener un nivel de confianza. Esto permite iniciar sesión en una base de datos PostgreSQL con el usuario \"repmgr\" sin autenticación. Si Pgpool se expone externamente, un atacante podría usar este usuario para acceder al servicio. Esto también está presente en el diagrama Helm de Kubernetes bitnami/postgres-ha."
    }
  ],
  "lastModified": "2026-06-17T08:45:54.693",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:bitnami:*:*:*:*:*:postgresql:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B227ABBF-D7EE-4E2C-ACCC-893DF02D8010",
              "versionEndExcluding": "16.0.0"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:bitnami\\/pgpool:*:*:*:*:*:docker:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D03A055-CE7B-4DA8-BC58-CE5EF3C448AC",
              "versionEndExcluding": "4.6.0-1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}